trustwalletcard[.]top

Analysis of trustwalletcard.top shows it was registered on 21 February 2026 through NiceNIC International Group Co., Limited and immediately pointed to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain resolves to Cloudflare nameservers fay.ns.cloudflare.com and ishaan.ns.cloudflare.com, indicating the use of a reputable CDN service to mask the true hosting environment. No TLS certificate is presented, so all HTTP traffic is unencrypted. The HTTP response returned the generic page title “Just a moment…”, suggesting the site may have been serving a Cloudflare challenge page or a placeholder page before being taken offline.

The content was classified as a crypto‑related impersonation of the Trust Wallet brand, matching the “Crypto Scam” label in the intelligence feed. The site has been actively blocked by the PhishDestroy feed and is listed on at least one additional security blocklist. VirusTotal scans recorded detections from three of ninety‑three antivirus engines, confirming that independent scanners have observed malicious characteristics. The current status is offline, which limits immediate interaction but does not remove the risk of future reactivation or reuse of the same infrastructure.

Defenders should continue to monitor the IP 188.114.96.3 and the associated Cloudflare ASN for any resurgence, add the domain to local blocklists, and enforce outbound filtering that blocks connections to untrusted TLS‑less endpoints. Because the domain leverages a high‑reputation CDN, traditional URL‑based filtering may miss subsequent subdomains, so threat‑intel feeds that track Cloudflare‑hosted malicious domains should be consulted regularly. Organizations that use Trust Wallet for cryptocurrency transactions should educate users about unsolicited links that reference the brand and advise verification of TLS certificates before entering credentials.